[Bro] feeding bro cluster with parameters without restarting it

[Azoff, Justin S]

> On Mar 6, 2017, at 6:42 AM, william de ping <bill.de.ping at gmail.com> wrote:
> 
> Well, its hard to provide you with this information

Right but you are saying things are not efficient and slow, so I would expect that you have numbers to back up these statements.

How fast are you expecting this table to update?  1ms? 1s? 30s?  'slow' is relative, and you haven't said what your expectations are, just that things aren't working.

> As a process, writing to a remote file and reading from that remote file into a bro table, it is not the most efficient way to perform such a task.

What remote file?  Are you using NFS or something?  Again you are saying things are not efficient, but you have not provided any information that proves this.

You said you are writing 3 lines per second and that each line has 3 fields.  This means that you are writing maybe 300 bytes/second to a file.  This is not an extreme amount of data and it's not really possible to be inefficient with 3 lines per second.


-- 
- Justin Azoff